{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-48673", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-25T13:44:28.321Z", "datePublished": "2024-05-03T14:51:44.955Z", "dateUpdated": "2026-08-05T08:51:42.988Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:51:42.988Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: Fix possible access to freed memory in link clear\n\nAfter modifying the QP to the Error state, all RX WR would be completed\nwith WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not\nwait for it is done, but destroy the QP and free the link group directly.\nSo there is a risk that accessing the freed memory in tasklet context.\n\nHere is a crash example:\n\n BUG: unable to handle page fault for address: ffffffff8f220860\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060\n Oops: 0002 [#1] SMP PTI\n CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S OE 5.10.0-0607+ #23\n Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018\n RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0\n Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e <48> 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32\n RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086\n RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000\n RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00\n RBP: ffff91db62bacc00 R08: 0000000000000000 R09: c00000010000028b\n R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010\n R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040\n FS: 0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n \n _raw_spin_lock_irqsave+0x30/0x40\n mlx5_ib_poll_cq+0x4c/0xc50 [mlx5_ib]\n smc_wr_rx_tasklet_fn+0x56/0xa0 [smc]\n tasklet_action_common.isra.21+0x66/0x100\n __do_softirq+0xd5/0x29c\n asm_call_irq_on_stack+0x12/0x20\n \n do_softirq_own_stack+0x37/0x40\n irq_exit_rcu+0x9d/0xa0\n sysvec_call_function_single+0x34/0x80\n asm_sysvec_call_function_single+0x12/0x20" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - A remote peer reaching an AF_SMC listener drives smc_listen_work through the CLC handshake over TCP/IP; after smc_conn_create/smcr_link_init posts the RoCE QP, peer-driven abort/decline/teardown reaches smcr_link_clear, matching prior SMC listen-path UAF scores (e.g. CVE-2024-56640).\nAC:L - The attacker initiates connect/abort/disconnect loops that both put the QP into Error (flushing RX WRs into the recv tasklet) and free the link without draining the CQ, so they control the race and can retry indefinitely.\nPR:N - The CLC handshake and subsequent link teardown run before any application authentication; an unauthenticated remote peer only needs to reach a listening SMC service—no local account or capability is required.\nUI:N - Once an SMC server is already listening, the attacker alone opens the TCP/SMC connection and forces teardown; no additional victim action is required at exploit time.\nS:U - The UAF corrupts in-kernel SMC/RDMA objects (smc_link, wr_rx buffers, CQ poll state) within the same host kernel authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free of link/QP-associated memory still referenced from smc_wr_rx_tasklet_fn via qp_context after free; reclaiming that heap object yields an attacker-shaped arbitrary read primitive.\nI:H - The softirq path writes through the freed link (and related IB CQ poll state), enabling classic heap-spray UAF write/control-flow hijack primitives as with other kernel UAFs.\nA:H - The fix commit documents a real kernel oops/page-fault in smc_wr_rx_tasklet_fn → mlx5_ib_poll_cq on freed memory, so availability impact is a full kernel crash even without further exploitation." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/smc/smc_core.c", "net/smc/smc_core.h", "net/smc/smc_wr.c", "net/smc/smc_wr.h" ], "versions": [ { "version": "bd4ad57718cc86d2972a20f9791cd079996a4dd6", "lessThan": "89fcb70f1acd6b0bbf2f7bfbf45d7aa75a9bdcde", "status": "affected", "versionType": "git" }, { "version": "bd4ad57718cc86d2972a20f9791cd079996a4dd6", "lessThan": "e9b1a4f867ae9c1dbd1d71cd09cbdb3239fb4968", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/smc/smc_core.c", "net/smc/smc_core.h", "net/smc/smc_wr.c", "net/smc/smc_wr.h" ], "versions": [ { "version": "4.11", "status": "affected" }, { "version": "0", "lessThan": "4.11", "status": "unaffected", "versionType": "semver" }, { "version": "5.19.9", "lessThanOrEqual": "5.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.19.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/89fcb70f1acd6b0bbf2f7bfbf45d7aa75a9bdcde" }, { "url": "https://git.kernel.org/stable/c/e9b1a4f867ae9c1dbd1d71cd09cbdb3239fb4968" } ], "title": "net/smc: Fix possible access to freed memory in link clear", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2022-48673", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-05-31T18:55:55.049793Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:16:35.822Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:17:55.722Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/89fcb70f1acd6b0bbf2f7bfbf45d7aa75a9bdcde", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/e9b1a4f867ae9c1dbd1d71cd09cbdb3239fb4968", "tags": [ "x_transferred" ] } ] } ] } }